Monitoring networks

ABSTRACT

Methods and systems for determining a correction factor for use in monitoring network traffic, said network traffic comprising a plurality of flows of data units, each flow having associated therewith a flow identifier, said data units having associated therewith a path characterization metric; the method comprising the steps of: selecting a subset of flow identifiers from the overall set of flow identifiers; determining, in respect of flows having associated therewith flow identifiers from said selected subset of flow identifiers, which flows if any are persistently irregular flows; determining a first measure of the total of the accumulated path characterization metrics associated with data units of said selected subset of flows; determining a second measure indicative of the proportion of said total measure contributed by said persistently irregular flows; and determining a correction factor in dependence on the first and second measures.

This application is the U.S. national phase of International ApplicationNo. PCT/GB2007/002397 filed 26 Jun. 2007 which designated the U.S. andclaims priority to European Application No. 06253317.9, filed 26 Jun.2006 the entire contents of each of which are hereby incorporated byreference.

TECHNICAL FIELD

The present invention relates to methods and systems for monitoringnetworks, for example data networks such as the Internet. In particular,embodiments of the present invention relate to methods and systems fordetermining a correction factor which may be used in monitoring networktraffic traversing a network. Embodiments of the present invention alsorelate to methods and systems for controlling a capability of a network.

BACKGROUND TO THE INVENTION AND PRIOR ART

Characterising the paths through a network is a basic capability thatlies beneath routing, congestion control and provision of differentiatedquality of service. Networks can be layered on top of other networks,but path characterisation is useful at any layer, whether the networkconsists of Ethernet switches, Internet Protocol (IP) routers, orgeneral purpose computers arranged in what is often called an overlaynetwork, such as a peer-to-peer network. In each case, a unicast paththrough a network is the sequence of forwarding nodes and links betweena sending end-node and a receiving end-node. The path between any twoend-nodes is determined by the routing system.

Characterisation of a network path involves taking some measure of thecombined effect of all the forwarding nodes and links on the path. Forinstance, the propagation delay of a network path is the sum of all thepropagation delays of each link. Similarly, the hop count of the path isthe sum of how many nodes forward data on the path. Or the congestionalong a path is the combination of the congestion at each node or linkalong the path. Congestion is typically defined as the probability ofthe offered load not being served, so the way to combine a number ofcongestion metrics into a congestion metric that characterises the pathis to take the combinatorial probability of congestion at every node onthe path.

Given there are a huge number of possible paths through a network, anefficient way to characterise any particular path is for the nodes onthe path to solely characterise their local contribution to each pathmetric. Then, as they forward data, they combine their localcontribution to the path metric into each unit of data as they forwardit (whether frames or packets, etc). They must use the appropriatefunction for combining their local characterisation with thecharacterisation accumulated so far in the data being forwarded.

For instance, if the characterisation of propagation delay is required,a field in the header of each packet may be standardised in order tocarry a value representing propagation delay. Then each node can add itslocal characterisation of propagation delay to the value arriving in theheader and replace the result in the header as the new value to beforwarded to the next node. In this way each value in each data headeraccumulates the path's propagation delay as it traverses the path.Equivalently, each forwarding node could subtract rather than add itslocal characterisation from the value in each header. As long as thecombining function chosen was standardised and appropriate, the headersof data packets would accumulate the characterisation of the path usedby the data.

An appropriate combining function for congestion is that forcombinatorial probability. For instance, if the value of congestionarriving at forwarding node j in a data header is h_(j), and the localcharacterisation of congestion is m_(j), then the node should forwarddata with the value of the combinatorial probability of bothh_((j+1))=1−(1−h_(j))(1−m_(j)). This example illustrates that eachcharacteristic of a network path must be combined into the header ateach forwarding node using the combining function appropriate to themetric concerned.

The above general technique for characterising each path through anetwork only allows the receiving end-node to see the characterisationof the complete path. Stated more generally, the technique allows eachnode on the path to characterise the path traversed so far—its upstreampath. However, frequent, timely path characterisation is most useful tothe sending end-node, not the receiver. More generally a frequent,timely characterisation of the remaining downstream path would be muchmore useful to each forwarding node on the path than a characterisationof the upstream path already traversed. With frequent, timelyinformation about the remaining path about to be traversed by eachpacket, the sending node, and each forwarding node would be able to maketimely decisions to control how much data they sent and on which path.

A prior patent application filed by the present applicant and publishedas WO2005/096566 proposed that each sending end-node could arrange toinitialise each path characterisation value in each data header so that,on average, after the same process of accumulating each forwardingnode's local characterisation of the path, the value in each data headerwould end up at a known target value by the time it reached thereceiver. The particular target value to aim for would need to bewell-known and standardised everywhere, typically zero.

As a consequence of this initial value set by the sender, each dataheader arriving at each forwarding node would carry a valuecharacterising its remaining downstream path, at least on average. Thesender could determine the best initial value for each data header usingfeedback about the whole path from the receiving node. The sender will,in effect, be continuously declaring the expected characterisation ofthe path within the packet headers of the data it sends into the path.When a paper relating to this invention was subsequently published[Briscoe05a] the term “re-feedback” was coined for the process ofre-inserting feedback from the receiver back into the forward data path.

Once each data packet carries the expected characterisation of itsremaining path through the network, network forwarding nodes can usethis information to control their operation. This network control mightconflict with an individual sender's self-interest. For instance, if theheader value characterises congestion on the downstream path, thenetwork may wish to limit the rate that data can be sent into such acongested path by some pre-agreed formula. This is an example of a casewhere the individual's self-interest is at odds with the general good ofother users of the network, so the network may wish to police the rateallowed for each user to meet some wider objective, such as fairness.Such a policing function was described in another patent applicationfiled by the present applicant and having application numberPCT/GB2006/000417. However, as soon as forwarding nodes try to use theinformation the individual sender gives them against the sender's owninterests, it would seem likely that the individual sender will betempted to falsify the information.

Some possible scenarios resulting from cheating are shown in FIG. 1. Inthe lower half of the figure, a sender S₁ (labelled 10) is shown sendingdata to a receiver R₁ (labelled 16) over a route through networks N₁, N₂and N₄ (labelled 11, 12 and 14 respectively) chosen from a widerselection of networks additionally including networks N₃ and N₅(labelled 13 and 15 respectively) by the routing protocol. Aligned withthis view of the path through the internetwork is a plot of downstreampath congestion in one possible packet traversing the path.Alternatively, the same plots could represent the average of the pathcharacterisation metrics in a flow of packets along the path. Of course,downstream congestion is just one possible path characterisation metricthat could be illustrated.

It can be seen that, as the packet traverses the path of networkelements 18, those that are congested reduce the path characterisationvalue in the packet's header by an amount associated with their localcongestion. It will noted that there will usually be several networkelements 18 within each network, but for simplicity only those at anentry or an exit point of each network are shown. Any of the networkelements may have an associated step-change in the graph in the upperhalf of FIG. 1.

Five possible scenarios are illustrated in the upper part of the figure,labelled a-e. In scenario (a) the source initialises the header valuecorrectly so that it arrives at the destination R₁ set to the targetvalue zero. In this case, at each point on the path the value in theheader then correctly represents downstream congestion from that pointto the destination. But in scenario (b), the source has not initialisedthe header value to a sufficiently high value, so it undershoots thetarget just before the destination, somewhere within network N₄. Eachsubsequent scenario c-e shows the source initialising the header valueto progressively lower values, so that in scenario (c) the packetbecomes negative in network N₂, in scenario (d) it becomes negative innetwork N1 and in scenario (e) it is negative when it is initialised, soit is never positive in any network.

A further patent application filed by the present applicant andpublished as WO2005/109783 proposed a function at the egress of anetwork to test whether the sender was indeed initialising header valuesso that, on average, they reached the agreed constant value at thedestination, and to sanction any flows that appeared to be understatingtheir path's characterisation, for instance by dropping a commensurateproportion of the data. We generally call these functions that testmetric validity ‘dropping functions’ even though sanctions short ofdropping may be chosen in practice, such as packet truncation or eventriggering off-line sanctions such as invoking penalty clauses incontracts.

We collectively call the above policing functions and dropping functions‘incentive mechanisms’, because it can be shown that sanctions againsttraffic not declaring truthful path metrics can be arranged so that thesender's most successful strategy will be to honestly declare thecharacterisation of the path. However, the sender will only adopt suchan honest strategy if it is actually trying to send information to areceiver. But not all potential senders conform to this stereotype.There may be malicious parties who are willing to send traffic into thenetwork merely to disrupt other people, irrespective of whether theyhave any useful information to send, or anyone to send it to. Forsenders with such malicious motives, there will be no incentive todeclare the path metric honestly when sending such dummy traffic. Takingthe congestion path metric as an example, such a malicious sender islikely to declare a very low or even zero level of congestion on thepath, in order that any rate policer using the congestion informationwill allow it to send as fast as possible.

Such dummy data from a malicious sender may well be dropped at theegress of the network, or earlier, because its initially declaredcharacterisation of path congestion will have been insufficient toremain above the target level once decremented along the path. However,it may well have still caused problems earlier in the network, beforebeing dropped. It may be the sender's objective to cause problems withinthe network, rather than to reach a destination across the network.Embodiments of the present invention aim to prevent these problems.

We said that characterising the paths through a network is a basiccapability that lies beneath routing, congestion control and provisionof differentiated quality of service. Many of these uses of pathcharacterisation take the sum of the characterisations of many pathsover time. This is particularly so within a network and betweennetworks, where aggregate traffic is handled, rather than single flows.The sum can be used to determine an average, or to determine the totaleffect that one network has on another.

However, any flows of traffic from dishonest senders will pollute suchaggregate sums, because they do not truly reflect the characteristics ofthe downstream paths they claim to reflect.

Without loss of generality, we will make the following discussion moreconcrete by assuming that it has been arranged that a numerically higherpath characterisation is treated less favourably by the network, and itstarget value is zero. Therefore, it will be in the interest of amalicious sender to understate the path characteristic, and such datawill eventually undershoot the zero target somewhere within the network.Therefore we can say that the flows that are of concern are those forwhich the lifetime balance has become persistently negative. It may bethat not all data packets in the flow carry negative values, but whenall the header values of all the packets within such flows areconsidered as a whole, the sum effect is negative. We will call these‘persistently negative flows’.

One particularly serious example of the damaging effect of persistentlynegative flows is the case where networks might agree to use the sum ofpath characterisations as the metric by which one network penalises theother if it has failed to deliver an agreed quality of service. Such ametric might further be used by one network to compare the qualities ofroutes through two different networks and from time to time to changeits choice of routing to ensure it uses the best quality or cheapestdownstream network. If the sum is polluted by persistently negativeflows, the decisions made based on the sum may be incorrect. Indeed, itmay even be in a malicious network's interest to create dummy traffic inorder to pollute the sum, so that a neighbouring network makes adecision to the malicious network's advantage.

A specific example of this problem is where the characterisations ofdownstream congestion are summed together in all traffic crossing theborder between two networks. This sum should represent the penalty thatthe upstream network should be made to suffer for all the congestion ithas allowed its users to cause in downstream networks. Two networksmight agree that the upstream network should keep this sum below acertain threshold, or perhaps multiple thresholds will be set, each withan increasing penalty if they are exceeded. Or, more generally, theupstream network may agree to pay the downstream network a chargeproportional to the sum. In all these cases, the penalty will beunderstated if persistently negative flows are included in the sum. Andif the penalty is understated, the upstream network may be encouraged tocontinue to allow malicious senders to understate congestion pathmetrics. Or indeed, the upstream network may be encouraged to create itsown dummy traffic with persistently negative header values and send itinto a neighbouring network to reduce the overall sum used to determinepenalties it must suffer, by offsetting the positive values in otherflows with the negative values in its dummy traffic.

REFERENCES

-   [Briscoe05a] Bob Briscoe, Arnaud Jacquet, Carla Di    Cairano-Gilfedder, Alessandro Salvatori, Andrea Soppera and Martin    Koyabe (BT), “Policing Congestion Response in an Internetwork Using    Re-Feedback,” In: Proc. ACM SIGCOMM'05, Computer Communication    Review 35 (4) pp. 277-288 (August, 2005). DOI:    http://doi.acm.org/10.1145/1080091.1080124

The most relevant prior disclosures known to the applicant are theapplicant's own publications on the subject of re-feedback, includingthe above referenced patent applications (WO2005/096566, andWO2005/109783) and academic paper [Briscoe05a] as well as standardssubmissions [Briscoe05j] [Briscoe06a] and further academic papers andtechnical reports [Briscoe04c] [Briscoe05f] [Jacquet05] as well as afurther patent application (WO/2005/096567).

Other researchers have often tried to attack the published re-feedbackmechanisms, but few of these attacks are published and only one of theseattempts has been relevant to the particular problem identified here.This concerted attempt to attack the previously published aspects of there-feedback protocol has itself been published and presented by StevenBauer, who identifies a general, but not the specific problem thatembodiments of this invention aim to solve. Bauer highlighted theproblem of senders with motivations other than to send information toreceivers [see Bauer05 and Bauer06 for example]. As with all of theother publications above, these do not identify exactly what the bestproblem to solve is, or how to solve it.

Finally, an older patent application filed by the present applicant andpublished as WO/1999/065184 may be tangentially relevant to the presentinvention. This covered the idea of random sampling of trafficmeasurements used for charging so that one party to a contract coveringtraffic measurements could check on the readings of the other withouthaving to account for all the traffic.

REFERENCES

-   [Bauer05] Steven Bauer, “Incentive Misalignment under    Congestion-Based Pricing”, Presentation to member-only consortium on    Web (password protected) (November, 2005).    <http://cfp.mit.edu/groups/broadband/secure/docs/Steven_Bauer_(—)11-05.pdf>-   [Bauer06] Steven Bauer, Peyman Faratin and Robert Beverly,    “Assessing the assumptions underlying mechanism design for the    Internet”, In Proc First Workshop on Economics of Networked Systems    (NetEcon06).    <http://www.cs.duke.edu/nicl/netecon06/papers/ne06-assessing.pdf>-   [Briscoe04c] Bob Briscoe, Sébastien Cazalet, Andrea Soppera and    Arnaud Jacquet, “Shared Control of Networks using Re-feedback; An    Outline”, BT Technical Report TR-CXR9-2004-001 (September 2004).-   [Briscoe05f] Bob Briscoe and Steve Rudkin, “Commercial Models for IP    Quality of Service Interconnect” In: BTTJ 23 (2) pp. 171-195 (April,    2005).-   [Jacquet05] Arnaud Jacquet, Bob Briscoe and Alessandro Salvatori “A    Path-Aware Rate Policer: Design and Comparative Evaluation” BT    Technical Report TR-CXR9-2005-006 (October, 2005)-   [Briscoe05j] Bob Briscoe, Arnaud Jacquet and Alessandro Salvatori,    “Re-ECN: Adding Accountability for Causing Congestion to TCP/IP,”    Internet Engineering Task Force Internet Draft (March, 2006):    http://tools.ietf.org/id/draft-briscoe-tsvwg-re-ecn-tcp-01.txt-   [Briscoe06a] Bob Briscoe (BT) “Emulating Border Flow Policing Using    Re-ECN on Bulk Data” Internet Engineering Task Force Internet Draft    (February, 2006):    http://tools.ietf.org/id/draft-briscoe-tsvwq-re-ecn-border-cheat-00.txt

SUMMARY OF THE INVENTION

According to a first aspect of the present invention, there is provideda method of determining a correction factor for use in monitoringnetwork traffic traversing a network, said network traffic comprising aplurality of flows of data units, each of said flows having associatedtherewith a flow identifier from a set of flow identifiers, said dataunits having associated therewith a path characterisation metric; saidmethod comprising the steps of:

-   -   selecting a subset of flow identifiers from said set of flow        identifiers;    -   determining, in respect of flows having associated therewith        flow identifiers from said selected subset of flow identifiers,        which flows if any are of a first type and which flows if any        are of a second type in dependence on an accumulated measure of        the path characterisation metrics associated with data units of        said flows, flows being determined to be of a first type in the        event that their respective accumulated measure is within a        first range, and flows being determined to be of a second type        in the event that their respective accumulated measure is within        a second range;    -   determining a first measure of the total of the accumulated path        characterisation metrics associated with data units of said        selected subset of flows; and    -   determining a second measure indicative of the proportion of        said first measure contributed by flows of said second type; and    -   determining a correction factor in dependence on the first and        second measures.

Also according to the first aspect, there is provided an for determininga correction factor for use in monitoring network traffic traversing anetwork, said network traffic comprising a plurality of flows of dataunits, each of said flows having associated therewith a flow identifierfrom a set of flow identifiers, said data units having associatedtherewith a path characterisation metric; said apparatus comprising:

-   -   means for selecting a subset of flow identifiers from said set        of flow identifiers;    -   means for determining, in respect of flows having associated        therewith flow identifiers from said selected subset of flow        identifiers, which flows if any are of a first type and which        flows if any are of a second type in dependence on an        accumulated measure of the path characterisation metrics        associated with data units of said flows, such that flows are        determined to be of a first type in the event that their        respective accumulated measure is within a first range, and        flows are determined to be of a second type in the event that        their respective accumulated measure is within a second range;    -   means for determining a first measure of the total of the        accumulated path characterisation metrics associated with data        units of said selected subset of flows; and    -   means for determining a second measure indicative of the        proportion of said first measure contributed by flows of said        second type; and    -   means for determining a correction factor in dependence on the        first and second measures.

According to preferred embodiments, the path characterisation metric maybe a metric indicative of a characteristic of a downstream path, butaccording to alternative embodiments, it may be a metric indicative of acharacteristic of an upstream path, or a metric indicative of acharacteristic of an end-to-end path. Other possibilities are that itmay be a metric indicative of a characteristic of the relevant network,or a part thereof.

The path characterisation metric may be a metric indicative ofdownstream, upstream or end-to-end congestion, or it may be a metricindicative of delay, number of hops, capability of network elements, orother such factors.

It will be noted that the step of determining the second measure maycomprise determining the measure “directly”. Alternatively, using anassumption that flows can be deemed either to be of a first type (e.g.persistently irregular over a time period in question) or of a secondtype (e.g. not persistently irregular over a time period in question),the second measure may be derived “indirectly”, by first determining theproportion of the first measure contributed by flows of the first type,then deriving the proportion of the first measure contributed by flowsof the second type therefrom.

The data units may be data packets, frames, messages or softwareobjects, for example.

According to a second aspect of the present invention, there is provideda method of controlling a capability of a network using a correctionfactor determined in accordance with a method according to the firstaspect, comprising controlling the capability in dependence on thecorrection factor.

Also according to the second aspect, there is provided apparatus forcontrolling a capability of a network using a correction factordetermined in accordance with a method according to the first aspect,the apparatus comprising means for controlling said capability independence on said correction factor.

The capability may relate to policing congestion control, routing, orthe provision of differentiated quality of service, for example.

Underlying preferred embodiments of the present invention is therealisation that an aggregate of path characteristics excluding those inpersistently irregular flows is best found by finding an unbiasedestimate of the sum of all the header values in all the persistentlyirregular flows, rather than merely trying to remove as many of thesepolluting values as possible from the sum.

For the avoidance of doubt, it is worth pointing out at this stage thatthe meaning of the word “irregular” in the context of the above is themeaning corresponding more closely to the words “unexpected” or“dishonest”, rather than to words such as “jagged” or “arrhythmic”. Itwill thus be understood that the expression “persistently irregularbehaviour” encompasses various types of malicious, accidental oruncontrolled behaviours even if these follow a pattern and are entirelyrepetitive. Such patterns may be intentionally and systematicallyabusive.

Usually, characterising irregular flows can be done by determiningwhether a suitable measure falls outside an acceptable range. In thecase of the re-feedback framework described earlier, the measure maytherefore be the lifetime balance of the downstream congestion metricand the range may consist of positive values, which means that“persistently irregular” flows are indeed “persistently negative” flows.

It will therefore be noted that terms such as ‘negative flow’ are usedoften in relation to flows of a type which are likely to be deemed to be‘irregular’, in particular in later sections of this descriptionrelating in detail to preferred embodiments of the invention using there-feedback framework, but that this not intended to be limiting—this isdone merely in order to simplify the description of those embodiments ofthe invention. It will be understood that this is generally applicablein relation to situations wherein a path characterisation metric usuallyhas a positive value, or should have a positive value, and wherein anegative value is likely to be indicative of dishonest, malicious,accidental or uncontrolled behaviour, or other such behaviour which maybe detrimental to the network, or to other network users in general. Itis of course possible for the reverse situation to be true, and for pathcharacterisation metrics usually to have a negative value, in which caseappositive value is likely to be indicative of dishonest, malicious,accidental, uncontrolled, or other such behaviour which may be to thedetriment of the network, or of other network users in general. In viewof this, the more general term “persistently irregular flows” is used.In the context of preferred embodiments of the present invention, a“persistently irregular flow” could thus be defined as “a flow with anaccumulated aggregate downstream path characterisation persistentlyoutside expected bounds as delineated by the generally agreed targetvalue for the system in question”. The expression may of course need tobe defined differently, but in a corresponding manner, in respect ofother embodiments of the invention. Even more generally, therefore,embodiments of the invention are applicable in relation to situations inwhich flows are determined to be of a “first type” (for example, notpersistently irregular) or of a “second type” (for example, persistentlyirregular), the determination being made in dependence on an accumulatedmeasure of the path characterisation metrics associated with the dataunits of those flows.

Persistently irregular flows (or “negative flows” in preferredembodiments in which positive values are deemed to be indicative of‘good’, ‘honest’ or ‘fair’ behaviour) cause two related detrimentaleffects: i) they pollute the sum over all flows and ii) if allowed tocontinue through the network they consume resources even though theirnegativity proves they have been sent maliciously. The distinguishinginsight behind preferred embodiments of the invention is that theability to be able to secure the re-feedback framework in order tosimplify provision of routing, congestion control or differentiatedquality of service depends on it not being possible to pervert the dataon which the incentive mechanisms rely. Actually removing the offendingtraffic is also important, but whether this is completely successful isnot so critical.

Therefore, it is at least as important to ensure that a sum taken overall flows does not account for any negative flows at all, as it is to beable to actually remove all the data carried in negative flows from thesystem. This is because incentive mechanisms rely on the sum itself notbeing polluted by persistently negative flows, irrespective of whethernegative flows can be removed.

All the above disclosures identify the larger problem of malicioussenders being willing to send traffic irrespective of whether it will bedelivered. They also identify the more specific problem thatpersistently negative flows are a problem that will pollute the sumtaken over an aggregate of flows. But they do not identify that a usefulway to deal with the problem is to remove the sum of all the headervalues in all the persistently negative flows by finding an unbiasedestimate, rather than merely trying to remove as many of the pollutingvalues as possible.

For instance, a technique is suggested in [Briscoe05a] that breaks thesumming procedure down into time-slots, each still measuring the sum ofall flows over that duration and it removes any slots with a negativesum. But this still allows persistently negative flows to hide beneath agreater sum of positive flows during each timeslot, so that usually nocompensation at all will be made for the persistently negative flows.

Also, another attempt to solve the problem was suggested in [Briscoe05a]where a function at the egress of the network detected negative flows(as already discussed with reference to WO2005/109783) and passed hintsupstream to droppers on other network elements within the network inorder to allow them to identify which flows were persistently negativeand sanction them earlier upstream. This was suggested because thefunction for sanctioning negative flows required per-flow state, whichwas considered cost-effective at the last egress of the network, but noton interior routers.

However, unlike embodiments of the present invention, the interiorrouters could not compensate for the traffic in a negative flow that hadalready been transmitted before a hint arrived. Also, the mechanism wasonly feasible for detecting more seriously negative flows. The hints hadto be sent widely to many upstream nodes not just towards the sourceaddress that the negative flow appeared to be sent from. This wasbecause a cheating source sending data without any interest incommunicating with anyone else could spoof any source address it wishedto use, because it would not require anyone to reply. As transmittingand processing these hints would clearly consume potentially largeamounts of network resources, it was proposed that a network elementshould not be required to read the hints nor to act on them unless ithad sufficient resources.

This solution also improves significantly on common sampling techniques.Indeed, in order to improve the measure of the aggregate downstream pathcharacterisation, it is not enough simply to pick packets at random andexamine the path characterisation metric they carry. It is not enougheven merely to examine subsequent packets of the same flow as well. Itis actually necessary to take into account all packets of the flows,from the time they started, until the time they end.

It is believed that no prior disclosures have identified a solution tothis problem. Other scenarios may exist where a technique is requiredthat removes only that data from a large bulk of data that has somecharacteristic that falls below (or above) a set threshold. Forinstance, intrusion detection systems have this goal, as do systems fordetecting unsolicited e-mail (spam). However, the goal of such systemsis to remove as much of the offending data as possible, not toaccurately measure how much of the offending data is (and was) present.In particular, when these systems are operated in real time on streamsof related data, they do not attempt to measure how much of the data ina stream had already been sent before it was detected.

Also underpinning embodiments of the present invention is theidentification of a mechanism to estimate the sum of all pathcharacterisations excluding those in persistently negative (i.e. or moregenerally, irregular) flows, but without having to keep account of eachflow separately.

It would seem that an accurate and useful approach to determine the sumof the path characterisations in many packets across many flows would beto accumulate the sum of each flow separately, then discard the sums ofthose flows that are numerically negative and sum only the remainder.However, this would require detecting the start and end of every flow ofpackets, and holding a balance separately for every flow. Even thoughthe amount of memory required to record the balance of each flow issmall, the memory required to store the flow identifiers is relativelylarge. For instance, with v4 of the Internet protocol a flow isidentified by a 5-tuple of source and destination IP address (2×32b),source and destination port number (2×16b) and the protocol ID (8b),making 104b in all. Although storing and matching against per-flow statewould be feasible for small numbers of flows, such a procedure becomesexpensive in terms of the sheer volume of processing and memory requiredwhen handling very large numbers of flows. The problem of accounting forevery flow becomes particularly acute when a large proportion of theflows are very short, in the extreme flows consisting of single packets,which is a characteristic of much traffic between computers. Indeed, ifa malicious attacker knows that a network is accounting for every flow,it can send single packets with uncorrelated flow identifiers, in orderto quickly exhaust the memory resources of the accounting system.

Preferred embodiments of the present invention select a truly randomsample to give a good estimator for the sum of all pathcharacterisations in persistently negative flows, but without having tomeasure every flow.

Note that [Briscoe06a] discloses a random selection mechanism fordetecting highly negative flows, but it is not for the same purpose asthe present invention, and it would not solve the present problem. Itmerely finds the most strongly negative flows, in order to detectanomalies which may be due to system misconfigurations or attacks. Butthe random selection mechanism in [Briscoe06a] cannot provide anunbiased estimate of the sum of all the flows excluding all the negativeones, which is the purpose of embodiments of the present invention. Toachieve this, a measurement system like that of [Briscoe06a] would haveto be able to travel back in time once it had detected a persistentlynegative flow, in order to compensate for the negative sum of that flowbefore it was detected. Embodiments of the present invention allow forcompensation to be made for persistently negative flows without havingto detect every negative flow and they make sure that those flows theydo detect are detected from the very start.

BRIEF DESCRIPTION OF THE DRAWINGS

Preferred embodiments of the present invention will now be describedwith reference to the appended drawings, in which:

FIG. 1 illustrates some possible scenarios resulting from a “cheating”party providing dishonest or incorrect path characterisation metrics toone or more other parties on a network path;

FIG. 2 is a graph illustrating a problem of bulk metering;

FIG. 3 is a flow-chart illustrating a congestion volume samplingprocess; and

FIG. 4 is a flow-chart illustrating an unbiased congestion volumeestimation process.

DESCRIPTION OF THE EMBODIMENTS

The re-feedback framework [Briscoe05a] is designed to make it extremelysimple to measure the sum of path characterisations at a network node,such as a border between networks.

For instance, taking congestion as the metric, to measure the volume ofdownstream congestion V passing through a network node over apotentially long period of time such as a month, the following formulasuffices,V=Σs _(i) h _(i),  (1)where s_(i) is the size of each packet (indexed by i) and h_(i) is theheader value for congestion in that packet. Note that the index i ismerely used here for notational convenience to distinguish betweenpackets; packets do not actually carry the index i in their headers.

In one proposed future embodiment of the re-feedback protocol, thesecongestion header values were considered to be represented as realnumbers (to some degree of precision) in a multibit field in the datapacket header. But a version of congestion re-feedback called re-ECN hasalso been proposed [Briscoe05j] that will fit in the extremely limitednumber of available bits in the current Internet Protocol (IP) version 4header. In this re-ECN proposal, congestion values h_(i) can only takethe values −1, 0 or +1.

Therefore, to measure the volume of downstream congestion passingthrough a network node, all that would be necessary to implementequation (1) would be to count the volume of packets marked +1 (termedpositive packets) and subtract the volume of those marked −1 (termednegative packets). This technique was originally proposed in[Briscoe05a]. We call techniques like this one naïve techniques, becausethey do not exclude persistently negative flows.

Note that the precise details of which bits of a packet header are usedfor which of these three header values, or whether a few discreteintegers or many discrete integers are used to improve the precision ofrepresenting header values, are not necessary to be able to understandthe invention. It will be sufficient to consider the header values h_(i)merely as real numbers represented to some precision.

In order to remove the polluting effect of persistently negative flows,the invention uses per-flow state for a small but truly random sample ofthe traffic crossing a border. For instance, to meter the bulkcongestion volume passing from an upstream network to a downstreamneighbour, the sum metered using the naïve technique can be inflated bythe proportion of excess negative bytes found in persistently negativeflows in the sample. The process involves the following steps:

-   -   (1) the formula for inflating the congestion volume    -   (2) a random sampling mechanism    -   (3) a process for neighbouring networks to agree on the inflated        measurement

The third step is only necessary if the measurement is intended to beused to meter some value that regulates the interconnection arrangementsbetween two networks or between a network and a customer. This processwould typically be agreed beforehand in the contract between them.

To be concrete, and without loss of generality, in the following we takethe path characterisation metric being measured to be a metricindicative of downstream congestion, having a target threshold of zero,wherein the network reduces the header value when congestion isexperienced. Thus we are trying to exclude the measurements from allflows where the sum of all header values is less than zero.

Congestion Volume Inflation Formula

Consider a set of flows J, laid out along the horizontal axis in FIG. 2,ranked for visual convenience in order of downstream congestion volume.Each flow, index j, if metered on a per-flow basis would consist of somepositively marked volume V⁺ _(j) and some negatively marked V⁻ _(j) (thelatter variable being considered numerically negative). This notation isshown graphically for one of the flows on the left of the inset in thefigure. The sum of these two volumes is the downstream congestion causedby each flow, V_(j)=V⁺ _(j)+V⁻ _(j). As pointed out earlier, thisscenario holds no matter what the precision of the header values, evenif only three values of +1, 0 and −1 are available.

It may help to visualise this sum using each black shaded or stripedarea shown in each flow, which are actually all half the size of thissum. Each shaded area extends from the zero axis to the midpoint betweenthe positive and negative volume measurements for each flow, asillustrated for the individual flow shown on the left of the inset inthe figure, in which the accumulated positive markings of thisindividual flow are shown shaded black and the accumulated negativemarkings are shown striped. The height of any midpoint is always halfthe sum of the heights of the two points it lies between, which is whyeach shaded or striped area in the body of the diagram represents halfthe downstream congestion volume of each flow.

We want the sum of downstream congestion caused by all flows, exceptones that are negative:V _(f)=Σ_(∀jεJ)(V ⁺ _(j) +V ⁻ _(j))⁺,  (2)which is illustrated by twice the black shaded area shown above theaxis. Note that the notation X⁺=X if X≧0 or X⁺=0 otherwise.

If we just meter the bulk congestion volumes of positive and negativepackets in all flows crossing an interface over an accounting period, wewill get the (incorrect) bulk metered volume of congestion,V _(b)=Σ_(∀jεJ) V ⁺ _(j) +V ⁻ _(j),  (3)which is represented graphically by the black area above the axis minusthe striped area below it, all doubled. The problem is how to excludethe striped area below the axis, but without accounting separately forevery flow.

Assume for a moment that we can take a truly random sample of trafficcomprising the subset of flows S⊂J. If the sample is small enough sothat accounting separately for each flow is feasible, then we canmeasure downstream congestion both for the whole of the sample andsolely for those flows that are positive. Then we can inflate the bulkdownstream congestion volume measured without regard to flows by theratio between the two measures found in the sample, as to get anestimate of downstream congestion excluding persistently negative flows.E(V _(f))=α_(S) V _(b)where

$\begin{matrix}{\alpha_{S} = \frac{\sum_{\forall{j \in S}}\left( {V_{j}^{+} + V_{j}^{-}} \right)^{+}}{\sum_{\forall{j \in S}}\left( {V_{j}^{+} + V_{j}^{-}} \right)}} & (4)\end{matrix}$

However, there is a further complication. Even if all sources werehonest, a very small proportion of downstream congestion volume would becontained in flows that were negative overall. For instance, even ifevery source were honest and started every flow with a positive packet,some single datagram flows would be congestion marked, making themnegative but no further datagrams would need to be sent in that flow. Asimilar situation could occur if a burst of congestion marking occurredat the end of a flow. Therefore, we actually want a deflated fraction ofthe above estimate to take account of the inflation factor α_(H) thatwould be found if we performed the same two measurements on a set H ofpurely honest flows.E(V)=α_(S)/α_(H) V _(b),  (5)where α_(H) is defined for the set H of purely honest flows, just asα_(S) was defined for the set S in Eqn (4) above.Congestion Volume Sampling

Taking a truly random sample for inflating the bulk congestion measureusing the above formula is fraught with problems. A feature of there-feedback framework is that each honest flow will tend to start with apositive balance, which it will maintain by balancing negative withslightly delayed positive throughout its duration, but sometimes theremay not be a final balancing positive packet. This is because thenetwork always subtracts from header values, while the source alwaystries to compensate by introducing positive packets, preferablyanticipating likely subtraction by the network to ensure that a flowalways remains positive overall. Therefore, flows cannot be picked byrandomly selecting packets then looking for further packets with thesame flow ID. This would tend to bias towards the end of flows, oftenmissing off the positive bias at the start, while always including thenegative bias at the end.

If we want to avoid per-flow state for all flows, we cannot randomlyselect from packets that start flows. Even though the re-feedbackframework expects honest sources to identify the first packet of a newflow, we cannot rely on the first packet of every flow being identifiedby the source, because we are trying to also detect malicious flows. Andit is only possible to know that a packet starts a new flow if it iscompared against a list of all the currently active flows, whichcontravenes our original goal of not holding per-flow state.

We recommend a sampling mechanism that randomly picks a subset of thepossible flow IDs, and detects all packets that match the subset over aperiod, before moving on to another subset. Then, it is necessary totake the average of all the inflation factors from each subset, weightedby the volume of traffic each subset matched.

Obviously, the flow IDs used by Internet hosts are not random, becauseIP addresses, protocol IDs and port numbers are unevenly allocated andunevenly used, particularly because the port number space includes anumber of well-known ports. Also, it is quite likely that misbehaviouris concentrated into certain parts of the flow ID space. Therefore, overa measurement period, the aim would be for the samples to havecollectively covered most of the possible address space.

A preferred process for sampling traffic to determine an unbiasedestimator of some downstream path characterisation metric is shown inFIGS. 3 and 4. FIG. 4 shows the whole process and FIG. 3 shows thesub-process within either step 2 or step 9 of the whole process.

Over the duration of an accounting period (for instance a month), thepositive and negative path characterisation metrics in all packets areaccumulated without regard to flows into the variable V_(J,B) (step 1).

At some stage in the accounting period, a subset S₁ is selected from theset of all possible flow IDs (step 3). The subset is selectedindependently of the traffic actually being transmitted. That is,packets are not picked from actual traffic to determine the subset.Then, a meter monitors only packets with a flow ID in the subset S₁(step 4). The meter accumulates positive and negative metrics frompackets in subset S₁, holding a separate account of the sum for eachflow (step 5). After a time shorter than the accounting period (say 3days), the accounts for the flows in the subset S₁ excluding those flowswith negative accounts are added together into the variable V_(S1,f) andthe accounts for all the flows in the subset S₁ irrespective of whetherthey are negative are added together into the variable V_(S1,b) (step6). These two variables are stored (step 7). Some time later, or perhapsimmediately, the sub process of measuring a sample subset of flows isrepeated with a new subset of flow IDs (step 3). At the end of anaccounting period, all the measurements stored from each sample subsetof measurements V_(Sg,f) and V_(Sg,b), for g=1, 2, 3, . . . are taken tocalculate the inflation factor as (step 8). This inflation factor is themean of the inflation factors from each sample weighted by each samplesize. That isα_(S)=Σ_(∀g) V _(Sg,f)/Σ_(∀g) V _(Sg,b).

To calibrate the system, which should be done regularly butinfrequently, the same process as above (steps 3 to 8) should be used tocalculate a calibrating inflation factor α_(H) (step 2), but the subsetsof flows used H_(g) should be known to be correct and honest. This maybe achieved by simulating a real network, or by selecting only flow IDsbetween hosts known to be accredited, perhaps by random checks of theirsoftware before, during and after the calibration.

Finally, the inflation factor as calculated from samples randomlyselected during the accounting period (steps 3 to 8, summarised in theoverview diagram as step 9), and the calibration inflation factor α_(H)calculated from samples selected only from honest hosts during acalibration phase (steps 3 to 8 summarised as step 2) are used to givean unbiased estimate of the downstream path characterisation metric V(step 10) for the whole set of flows J, excluding negative flows, byinflating the bulk metric V_(J,B) (taken at step 1) by the inflationfactor α_(S) (calculated at step 9) divided by the calibration inflationfactor α_(H) (calculated at step 2).

Even if all the flows are positive when accounted for as a whole,whenever a sampling technique only measures part of some flows, it willerroneously find some flows that appear to be negative overall.Therefore, the period over which a sample should be taken must be manytimes longer than the duration of flows that most traffic is in. Notethat this is not the same as “ . . . the duration of most flows”.

Agreement Between Neighbours

Often two neighbouring networks will need to meter some characteristicof the traffic passing between them as part of their contract, forinstance, to check that they are keeping within a service levelagreement or to determine usage charges.

Whenever such metering is necessary, to a certain extent the two partiesmust be able to trust each other or a third party. Even if they bothmeter the traffic, either party can simply lie about what their metersaid in order to dispute the other's reading. However, one can onlybuild trust in the other if the other party's reading consistentlyagrees with the one read privately.

If the contract between neighbours depends on a bulk measure meteredcontinuously but inflated by a sampled measure, it is important that theparty in control of the traffic cannot infer when sampling is occurring.Otherwise it can condition traffic to be well-behaved during samplingbut behave badly otherwise.

It may be possible for both parties to hire a trusted third party toconduct the measurements independently of each of their interests. Thethird party might actually operate the meter physically secured againstboth interested parties, or it might produce a tamper-resistant meterfor them to use that neither party believes can be influenced by theother.

If sampling is used but without a third party, given neither interestedparty will want to inform the other when or what they are sampling, itwill not be possible to ensure that both parties measure the same data.The two parties can only build trust in each other if their two readingsare close, or if they are neither persistently higher nor lower than theother. The two parties readings will only be close to each other if thesampling technique is strongly representative of the traffic in total.

In summary, the problem of neighbouring networks agreeing on a meterreading is not fundamentally different if sampling is used, but samplingdoes make it more difficult to build trust in each other's measurementsif the resulting readings are unlikely to match closely.

1. A method of determining a correction factor for use in monitoringnetwork traffic traversing a network, said network traffic comprising aplurality of flows of data units, each of said flows having associatedtherewith a flow identifier from a set of flow identifiers, said dataunits having associated therewith a path characterisation metric; saidmethod comprising the steps of: selecting, using a network node, asubset of flow identifiers from said set of flow identifiers;determining, in respect of flows having associated therewith flowidentifiers from said selected subset of flow identifiers, which flowsif any are of a first type and which flows if any are of a second typein dependence on an accumulated measure of the path characterisationmetrics associated with data units of said flows, flows being determinedto be of a first type in the event that their respective accumulatedmeasure is within a first range, and flows being determined to be of asecond type in the event that their respective accumulated measure iswithin a second range; determining a first measure of the total of theaccumulated path characterisation metrics associated with data units ofsaid selected subset of flows; and determining a second measureindicative of the proportion of said first measure contributed by flowsof said second type; and determining a correction factor in dependenceon the first and second measures.
 2. A method according to claim 1,wherein said path characterisation metric is a metric indicative of acharacteristic of a downstream path.
 3. A method according to claim 1,wherein said path characterisation metric is a metric indicative of acharacteristic of an upstream path.
 4. A method according to claim 1,wherein said path characterisation metric is a metric indicative of acharacteristic of an end-to-end path.
 5. A method according to claim 1,wherein said path characterisation metric is a metric indicative ofcongestion.
 6. A method according to claim 1, wherein said pathcharacterisation metric is a metric indicative of one or more of delay,number of hops, and capability of network elements.
 7. A methodaccording to claim 1, wherein said step of determining said secondmeasure comprises determining said measure directly.
 8. A methodaccording to claim 1, wherein said step of determining said secondmeasure comprises determining the proportion of said first measurecontributed by flows of said first type, whereby to enable theproportion of said first measure contributed by flows of said secondtype to be derived therefrom.
 9. A method according to claim 1, whereinsaid data units comprise data packets, frames or messages.
 10. A methodaccording to claim 1, wherein a flow is determined to be of a first typein the event that the respective accumulated measure is within a firstrange indicative that data units of said flow have associated therewitha path characterisation metric indicative of dishonest, malicious,accidental or uncontrolled behaviour, and a flow is determined to be ofa second type in the event that the respective accumulated measure iswithin a second range outside said first range.
 11. A method ofcontrolling a capability of a network using a correction factordetermined in accordance with claim 1, comprising controlling saidcapability in dependence on said correction factor.
 12. A methodaccording to claim 11, wherein said capability is selected from policingcongestion control, routing, and providing differentiated quality ofservice.
 13. Apparatus for controlling a capability of a network using acorrection factor determined in accordance with claim 1, the apparatuscomprising means for controlling said capability in dependence on saidcorrection factor.
 14. Apparatus according to claim 13, wherein saidcapability is selected from policing congestion control, routing, andthe provision of differentiated quality of service.
 15. A methodaccording to claim 1, wherein the first type of flow is persistentlyirregular over a time period, and the second type of flow is notpersistently irregular over the time period.
 16. Apparatus fordetermining a correction factor for use in monitoring network traffictraversing a network, said network traffic comprising a plurality offlows of data units, each of said flows having associated therewith aflow identifier from a set of flow identifiers, said data units havingassociated therewith a path characterisation metric; said apparatuscomprising: means for selecting a subset of flow identifiers from saidset of flow identifiers; means for determining, in respect of flowshaving associated therewith flow identifiers from said selected subsetof flow identifiers, which flows if any are of a first type and whichflows if any are of a second type in dependence on an accumulatedmeasure of the path characterisation metrics associated with data unitsof said flows, such that flows are determined to be of a first type inthe event that their respective accumulated measure is within a firstrange, and flows are determined to be of a second type in the event thattheir respective accumulated measure is within a second range; means fordetermining a first measure of the total of the accumulated pathcharacterisation metrics associated with data units of said selectedsubset of flows; and means for determining a second measure indicativeof the proportion of said first measure contributed by flows of saidsecond type; and means for determining a correction factor in dependenceon the first and second measures.
 17. An apparatus according to claim16, wherein the first type of flow is persistently irregular over a timeperiod, and the second type of flow is not persistently irregular overthe time period.
 18. An apparatus according to claim 16, wherein saidpath characterisation metric is a metric indicative of congestion. 19.An apparatus according to claim 16, wherein said path characterisationmetric is a metric indicative of one or more of delay, number of hops,and capability of network elements.
 20. An apparatus according to claim16, wherein said means for determining the second measure determinessaid second measure directly.
 21. An apparatus according to claim 16,wherein said means for determining the second measure determines theproportion of said first measure contributed by flows of said firsttype, and derives the proportion of said first measure contributed byflows of said second type to be derived therefrom.
 22. An apparatusaccording to claim 13, wherein a flow is determined to be of the firsttype in the event that the respective accumulated measure is within afirst range indicative that data units of said flow have associatedtherewith a path characterisation metric indicative of dishonest,malicious, accidental or uncontrolled behaviour, and a flow isdetermined to be of the second type in the event that the respectiveaccumulated measure is within a second range outside said first range.23. A method of determining a correction factor for use in monitoringnetwork traffic traversing a network, said network traffic comprising aplurality of flows of data units, each of said flows having associatedtherewith a flow identifier from a set of flow identifiers, said dataunits having associated therewith a path characterization metric; saidmethod comprising the steps of: selecting, using a computer, a partialsubset of flow identifiers from said set of flow identifiers;determining, in respect of flows having associated therewith flowidentifiers from said selected subset of flow identifiers, which flowsif any are of a first type and which flows if any are of a second typein dependence on an accumulated measure of the path characterizationmetrics associated with data units of said flows, flows being determinedto be of a first type in the event that their respective accumulatedmeasure is within a first range, and flows being determined to be of asecond type in the event that their respective accumulated measure iswithin a second range; determining a first measure of the total of theaccumulated path characterization metrics associated with data units ofsaid selected subset of flows; determining a second measure indicativeof the proportion of said first measure contributed by flows of saidsecond type; and determining a correction factor in dependence on thefirst and second measures.